The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade proftpd-dfsg | Jul 30, 2024 | Apr 4, 2017 |
| Freebsd | — | Upgrade proftpd | Jul 27, 2017 | Jul 27, 2017 |
| Oracle Solaris | — | Upgrade service/network/ftp to version 1.3.6-0.175.3.34.0.2.0 on Solaris 11.3 | Jul 18, 2018 | Apr 4, 2017 |
| Proftp Proftpd | — | Update ProFTP ProFTPd to the latest version | Nov 6, 2025 | Apr 4, 2017 |
| Suse | — | Upgrade proftpd-langUpgrade proftpd-pgsqlUpgrade proftpdUpgrade proftpd-sqliteUpgrade proftpd-docUpgrade proftpd-radiusUpgrade proftpd-mysqlUpgrade proftpd-develUpgrade proftpd-ldap | Apr 19, 2017 | Apr 4, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 4, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub